[go: up one dir, main page]
Scribd
Upload
3K views11 pages

MH2p Tutorial

The document provides incomplete and potentially faulty instructions for modifying a device's firmware through unauthorized means. It describes accessing the device's console through a custom login method, updating the firmware to allow further unauthorized changes, converting the device's region settings, installing additional media databases, patching software components, installing maps data, and other advanced commands. Users are warned to only proceed at their own risk and backup files before modifying anything.

Uploaded by

spam spam
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
3K views11 pages

MH2p Tutorial

The document provides incomplete and potentially faulty instructions for modifying a device's firmware through unauthorized means. It describes accessing the device's console through a custom login method, updating the firmware to allow further unauthorized changes, converting the device's region settings, installing additional media databases, patching software components, installing maps data, and other advanced commands. Users are warned to only proceed at their own risk and backup files before modifying anything.

Uploaded by

spam spam
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 11

The following instructions might be

incomplete and faulty

Only proceed on your own risk

Happy bricking!
1. Shell access via custom challenge/response method
Update with “SD Update” which will install custom public key for challenge/response login.
Hold two fingers in top right corner to enter SWUP (RED) Mode.

Press + Update

2
Everything should say N/A except ExceptionList. It is normal, just scroll down and press Start update.

After update finished, press + Resume

NOTE: ALL CHANGES ON UNIT SHOULD BE DONE IN RED MENU !!! HOLD 2 FINGERS IN TOP
RIGHT CORNER, UNIT WILL GO TO RED MENU, ONLY THEN YOU CAN CONTINUE WITH
FECS/CONVERSION.

When unit is in red menu, connection to unit can be done via D-Link DUB-E100. You need to change IPv4
address and mask to same as Harman uses.

3
Challenge is on telnet 172.16.250.2.48:22111

Copy CHALLENGE KEY and ask for a RESPONSE (Use generator, or ask somebody who provides you
access via tokens)

4
Paste response back to putty and press Enter. Putty should close. Now you have opened telnet access
and can connect with port 23.

MMX console Telnet: 172.16.250.248:23


Challenge Telnet: 172.16.250.248:22111

Note: If you can’t login, you are probably in normal, not in red menu. Go to red menu and try to login
then.

5
If you used EMMC method, password for root will be: harman_f, if you used challenge method, there
will be no
password, but only for one time! After reboot unit will ask again for a password. To disable password
you need to run these commands: (RUN ALL COMMANDS ONLY FROM RED MENU !!)
mount -t qnx6 /dev/mnanda0t177.2 /mnt/swup
cp /mnt/swup/etc/nopasswd /mnt/swup/etc/passwd
sync

Now, even after reboot, your unit will have no password.

6
2. Region conversion
Login to unit with telnet 172.16.250.248:23 and execute next commands:

touch /mnt/persist_new/swup/skipCheckMetaChecksumPROD
touch /mnt/persist_new/swup/skipCheckVariantPROD
touch /mnt/persist_new/swup/skipCheckInstallerChecksumPROD
touch /mnt/persist_new/swup/checkAllUpdatesPROD
touch /mnt/persist_new/swup/allowUserDefinedUpdate

Reboot unit by long press power button. Extract patched firmware to SD Card.
Press + User Defined > All > Remove selection from AMP* and DUC2H* > Start software update

After update finished, you must perform parametrization with VCP. Go to Can Procedures > Apps > Data
Container

Check 5F module and load file: A6_mib_4k0035165b.zdc

In data container check VISIBLE_LANGUAGES_EU or AVAIBLE_LANGUAGES_EU push Load Data. Restart


unit, EU languages list will be present on MENU now.

Go to Coding and change to:


COUNTRY NAVIGATION – EU
BAND SETTINGS FM TUNER – EU_RdW
BAND SETTINGS AM TUNER – EU_RdW
NAVIGATIO SYSTEM: enable

Go to Adaptation:

VEHICLE CONFIGURATION: SDS_Region_F: REGION_EU

NOTE: If you don‘t have sound in tuner after conversion, change PI_ignore to active in coding.

7
3. Installing gracenote

Put Gracenote2 and RadioStationDB folder to root of SD Card, and execute following commands:
cd / && mount -uw /fs/sdb0

mount -t qnx6 /dev/mnanda0t177.9 /mnt/gracenotedb && mount -uw /mnt/gracenotedb/

cp -Vrf /fs/sdb0/Gracenote2/Database/0/EU/* /mnt/gracenotedb/database && cp -Vrf


/fs/sdb0/Gracenote2/InfoFile/0/EU/Update.txt /mnt/gracenotedb/Update.txt && cp -Vrf
/fs/sdb0/Gracenote2/Version/0/EU/gracenote.json /mnt/gracenotedb/config/gracenote.json &&
umount /mnt/gracenotedb

mount -uw /mnt/misc1 && cp -Vrf /fs/sdb0/RadioStationDB/VW_STL_DB.sqlite


/mnt/misc1/rsdb/VW_STL_DB.sqlite

4. Do a backup before modifying or patching any files!


mount -uw /fs/sdb0/
cat /dev/fs0 > /fs/sdb0/fs0_mib2p
cat /eso/bin/apps/fecmanager > /fs/sdb0/fecmanager
cat /eso/bin/apps/componentprotection > /fs/sdb0/componentprotection

mkdir /fs/sdb0/fec_backup/
cp -f /mnt/persist_new/fec/* /fs/sdb0/fec_backup/

8
4. Patch SWaP and Component Protection
Put patched fecmanager according to the version and ExceptionList.txt to root of SD Card. Enter to red
menu, login with telnet to 172.16.250.248:23 console and execute following commands to replace
fecmanager:
mount -uw /fs/sdb0/
mount -t qnx6 /dev/mnanda0t177.1 /mnt/app
cp /fs/sdb0/fecmanager /mnt/app/eso/bin/apps/
chmod 777 /mnt/app/eso/bin/apps/fecmanager
mount -t qnx6 /dev/mnanda0t177.2 /mnt/swup
cp /fs/sdb0/fecmanager /mnt/swup/eso/bin/apps/
chmod 777 /mnt/swup/eso/bin/apps/fecmanager

And these to change ExceptionList.txt:


mount -uw /fs/sdb0/
rm /mnt/persist_new/fec/*
cp /fs/sdb0/ExceptionList.txt /mnt/persist_new/fec
chmod 777 /mnt/persist_new/fec/ExceptionList.txt

Optionally you can also do CP-OFF. Put patched componentprotection file on SD and
replace with following commands:
mount -uw /fs/sdb0/
cp /fs/sdb0/componentprotection /eso/bin/apps/componentprotection
chmod 777 fecmanager

9
5. Maps
Latest maps can be downloaded from https://app-connect.volkswagen.com/mapupdates/en/car/

Write navigation data to root of SD Card. Boot into normal mode,


insert SD, and start update.

10
6. Other commands:
Emergency mode:
echo active > /dev/rmgr/swup && echo swup-start > /dev/ooc/system && echo swup-emr-reset >
/dev/ooc/system

SWUP mode (RED MENU):


echo active > /dev/rmgr/swup && echo swup-start > /dev/ooc/system && echo swup-reset >
/dev/ooc/system

touch /mnt/persist_new/swup/developmentflag
mount -uw /mnt/system && touch /mnt/system/etc/startup_test_mode && mount -ur /mnt/system

Copying engdefs (GREEN MENU) from unit to SD:


mount -uw /fs/sdb0/
mkdir /fs/sdb0/engdefs_backup/
cp -r /mnt/app/eso/hmi/engdefs/* /fs/sdb0/engdefs_backup

Installing engdefs (GREEN MENU) from SD to unit:


mount -uw /fs/sdb0/
mount -t qnx6 /dev/mnanda0t177.1 /mnt/app
cp -r /fs/sdb0/engdefs /mnt/app/eso/hmi/engdefs/

11

You might also like